---
id: CVE-2026-57579
title: >-
  Alchemy is an open source content management system engine written in Ruby on
  Rails
summary: >-
  Alchemy is an open source content management system engine written in Ruby on
  Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET
  /api/pages/nested endpoint implemented by Api::PagesController#nested in
  app/control…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: AlchemyCMS
product: alchemy_cms
affected:
  - alchemy_cms < 7.4.15
  - 'alchemy_cms >= 8.0.0, < 8.0.15'
  - 'alchemy_cms >= 8.1.0, < 8.1.14'
  - 'alchemy_cms >= 8.2.0, < 8.2.6'
published: '2026-09-14'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T18:17:58.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57579'
references:
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/30888fb41d8b71fdfb3b116a7efccd851d73e1f3
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/5620e76f0d274d6f69f34281b7e46d01879f6b99
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/85702d9fe4e247649b1358900c5af853e83b4a3a
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/commit/a082dd0afe188d199f386a5e1db01987d0de807f
    label: security-advisories@github.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/pull/3982'
    label: security-advisories@github.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.15'
    label: security-advisories@github.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.15'
    label: security-advisories@github.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.14'
    label: security-advisories@github.com
  - url: 'https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
    label: security-advisories@github.com
  - url: >-
      https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-mqq5-j7w8-2hgh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T17:39:44.487415Z'
ingestedAt: '2026-09-14T18:12:17.161Z'
epss: 0.00648
epssPercentile: 0.48789
---

## Overview

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. Anonymous callers can retrieve restricted and unpublished page metadata that the sibling show action denies. When elements=true is supplied, PageTreeSerializer also returns element and ingredient content from restricted pages because PageTreePreloader and the serializer do not apply an ability check to those records. This issue is fixed in versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.